Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET SCAN Rapid POP3 Connections - Possible Brute Force Attack rev 6 2011-07-06
snort ET WEB_CLIENT Adobe Reader and Acrobat U3D File Invalid Array Index Remote Code Execution Attempt rev 2 2011-07-06
snort ET SCAN Rapid POP3S Connections - Possible Brute Force Attack rev 6 2011-07-06
snort ET TROJAN Win32/Fosniw MacTryCnt CnC Style Checkin rev 1 2011-07-06
snort ET POLICY Internal Host Retrieving External IP Via myip.ozymo.com rev 1 2011-07-06
snort ET TROJAN Backdoor.Esion CnC Checkin rev 1 2011-07-06
snort ET TROJAN Win32.Genome Initial Checkin rev 1 2011-07-05
snort ET SCAN DominoHunter Security Scan in Progress rev 1 2011-07-02
snort ET TROJAN Gozi Communication 2 rev 1 2011-07-01
snort ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter UPDATE SET SQL Injection Attempt rev 1 2011-07-01
snort ET ACTIVEX Ubisoft CoGSManager ActiveX Initialize method Buffer Overflow Vulnerability rev 2 2011-07-01
snort ET ACTIVEX Ubisoft CoGSManager ActiveX RunCore method Buffer Overflow Vulnerability rev 2 2011-07-01
snort ET ACTIVEX CygniCon CyViewer ActiveX Control SaveData Insecure Method Vulnerability rev 2 2011-07-01
snort ET WEB_CLIENT Adobe Acrobat Reader FlateDecode Stream Predictor Exploit Attempt rev 1 2011-07-01
snort ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter UNION SELECT SQL Injection Attempt rev 1 2011-07-01
snort ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter DELETE FROM SQL Injection Attempt rev 1 2011-07-01
snort ET WEB_CLIENT Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt rev 12 2011-07-01
snort ET WEB_SPECIFIC_APPS Wordpress plugin Flash Album Gallery pid Parameter INSERT INTO SQL Injection Attempt rev 1 2011-07-01
snort ET ACTIVEX LEADTOOLS Imaging LEADSmtp ActiveX SaveMessage Method Vulnerability rev 2 2011-07-01
snort ET WEB_CLIENT Adobe Acrobat Util.printf Buffer Overflow Attempt rev 1 2011-07-01
snort ET WEB_CLIENT Adobe Shockwave Director tSAC Chunk memory corruption Attempt rev 2 2011-07-01
snort ET SHELLCODE Possible %u41%u41%u41%u41 UTF-8 Heap Spray Attempt rev 1 2011-06-30
snort ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt rev 1 2011-06-30
snort ET SHELLCODE Possible %u4141%u4141 UTF-16 Heap Spray Attempt rev 1 2011-06-30
snort ET MOBILE_MALWARE XML Style POST Of IMSI International Mobile Subscriber Identity rev 2 2011-06-30
snort ET WEB_SPECIFIC_APPS SoftMP3 search Parameter SELECT FROM SQL Injection Attempt rev 1 2011-06-29
snort ET WEB_SPECIFIC_APPS SoftMP3 search Parameter UNION SELECT SQL Injection Attempt rev 3 2011-06-29
snort ET WEB_SPECIFIC_APPS SoftMP3 search Parameter DELETE FROM SQL Injection Attempt rev 3 2011-06-29
snort ET WEB_SPECIFIC_APPS SoftMP3 search Parameter UPDATE SET SQL Injection Attempt rev 1 2011-06-29
snort ET WEB_SPECIFIC_APPS SoftMP3 search Parameter INSERT INTO SQL Injection Attempt rev 1 2011-06-29
snort ET SCADA Siemens FactoryLink 8 CSService Logging Buffer Overflow Vulnerability rev 1 2011-06-28
snort ET TROJAN Win32.Vilsel Checkin rev 1 2011-06-24
snort ET WEB_SERVER Muieblackcat scanner rev 3 2011-06-24
snort GPL RPC portmap ypupdated request UDP rev 10 2011-06-22
snort ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter INSERT INTO SQL Injection Attempt rev 1 2011-06-22
snort GPL DNS named authors attempt rev 8 2011-06-22
snort GPL DNS named iquery attempt rev 9 2011-06-22
snort ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter UNION SELECT SQL Injection Attempt rev 1 2011-06-22
snort ET WEB_SPECIFIC_APPS PHP link Directory sbcat_id Parameter UPDATE SET SQL Injection Attempt rev 1 2011-06-22
snort ET MOBILE_MALWARE Android.YzhcSms URL for Possible File Download rev 1 2011-06-22